I have a long list of browser user agent strings pulled from website access logs which I would like to analyze to determine the TLS capabilities of our site's visitors in order to get a ballpark estimate of the impact that tightening up security settings would have.

I already have the user agents broken out by unique visitor counts, and I just need a script or utility of some kind to take that data and convert it into something that says X percent of users will be affected if we remove support for protocol Y or cipher suite Z. What is the most straightforward way to accomplish this?

  • 1
    Apache or nginx logs? Or something else? It might be more straightforward to collect TLS negotiated versions and ciphers directly through custom logging, rather than trying to match up user agents. – Maximillian Laumeister Oct 11 '18 at 23:02
  • ex. for apache serverfault.com/questions/727638/… – Maximillian Laumeister Oct 11 '18 at 23:04
  • 1
    Like @MaximillianLaumeister I believe that using the User-Agent string for that is the wrong path. As the TLS capabilities also depend on the underlying OS (name and version) as well as the configuration inside the browser. So two identical User-Agent strings being of 2 browsers running with different settings will yield different TLS capabilities, not even accounting for the fact that this string is optional and can be complete spoofed or "scrubed down" by proxies. Do either a live test (various ways) or collect data from current connections to assess your visitors profile. – Patrick Mevzek Oct 11 '18 at 23:19
  • You should also not bindly fiddle with configuration, just use default values "good enough" provided elsewhere like wiki.mozilla.org/Security/… it clearly shows the population eligible in each case. – Patrick Mevzek Oct 11 '18 at 23:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.